fix(deps): raise brace-expansion and fast-uri override floors for four OSV advisories (#20774)

Fixes #20769

Clause-②: no

## Summary

`Validate Package Dependencies` (OSV-Scanner against `pnpm-lock.yaml`)
flags two transitive copies that `origin/main` locks:

| Advisory | CVSS | Package | Locked on main | Fixed in |
|---|---|---|---|---|
| GHSA-6j4f-fj2g-mc7p | 7.5 | brace-expansion | 5.0.9 | 5.0.10 |
| GHSA-qhr7-859c-m2p7 | 7.5 | brace-expansion | 5.0.9 | 5.0.11 |
| GHSA-q2hr-2g5m-vwhr | 5.3 | brace-expansion | 5.0.9 | 5.0.12 |
| GHSA-hrr3-gc8f-f4qj | 4.8 | fast-uri | 3.1.7 | 3.1.8 |

Both fix versions are published (`npm view brace-expansion@5.0.12
version` returns 5.0.12, `npm view fast-uri@3.1.8 version` returns
3.1.8). This is the take-the-fix path: `osv-scanner.toml` is untouched
and still holds zero exemptions.

## Change

Two override targets are raised in `pnpm-workspace.yaml`, selectors
unchanged (both already sit on their major boundary):

- `'brace-expansion@>=5.0.0 <6.0.0'`: `^5.0.9` to `^5.0.12`
- `'fast-uri@<4.0.0'`: `^3.1.6` to `^3.1.8`

Each advisory-history comment is extended in the file's existing style
and names the new GHSA ids and #20769. The floor keeps this workspace's
own resolution from ever re-locking a vulnerable copy. Workspace
overrides do not reach downstream installs, so this PR does not claim to
fix a consumer's own copy.

## Lockfile

Regenerated with `pnpm install --lockfile-only` (pnpm 10.31.0, the
`packageManager` version), never hand-edited. The diff is 11 lines
changed on each side (22 total) and names only these entries: the two
override specifiers, `brace-expansion` 5.0.9 to 5.0.12 (package and
snapshot entries, plus the two `brace-expansion:` dependents' edges),
and `fast-uri` 3.1.7 to 3.1.8 (package and snapshot entries, plus the
one `fast-uri:` dependent's edge). Nothing unrelated moves, and the
scanned package count stays 1369. `pnpm install --frozen-lockfile`
passes on the result.

Other copies: none. Each package appears exactly once in the lockfile,
at the vulnerable version on main and at the fixed version on this
branch.

## Changeset decision

No changeset. A workspace-override raise plus a lockfile move publishes
nothing: no package's `files[]` content or declared range changes. The
precedent is the devalue override PR (#18942, commit `5e0a1b9e02`),
which touched exactly `pnpm-workspace.yaml` and `pnpm-lock.yaml` and
added no changeset. The two other OSV precedents (#20719, #20564) each
changed a published package's declared range, so they carried changesets
and are not the shape here. No empty changeset is added. `Check
Changeset` may stay red on this PR until a maintainer applies
`skip-changeset`; the author seat does not apply labels.

## What I ran

| Check | Result |
|---|---|
| OSV-Scanner v2.3.8 (SHA-256 verified against the release checksum
file), `--offline-vulnerabilities`, on `origin/main`'s lockfile | exit
1, exactly the four GHSAs above |
| The same scan on this branch's lockfile | exit 0, `No issues found`
(1369 packages) |
| `pnpm install --frozen-lockfile` | pass |
| `node scripts/pm/dispatch-gates.mjs --commands`, every derived command
run, then `--ran` | 21 derived, 21 run, 0 NOT-MEASURED, 0 UNRUN |
| Full `pnpm build` (under the shared verify lock, `--concurrency=2`) |
72/72 tasks pass |
| After the build: `check:dts-closure`, `check:dual-build-cjs-loads`,
`check:lean-entry-closure`, `check:sourcemap-no-sources-content` | all
exit 0 |
| `check:override-consistency`, `check:vendor-export-contract-resolve`,
`check:workspace-manifest-cycles`, `check:nul-bytes`,
`check-osv-exemptions` and the rest of the derived list | all exit 0 |

Not run: the per-package test suites of `minimatch` and `ajv` consumers.
The gate derivation selects none for a two-path lockfile and
workspace-yaml diff, and both bumps are patch-line moves inside the
ranges the dependents already declare. CI's shards cover them.

## Acceptance notes

None.

---
🤖 Generated with [Claude Code](https://claude.com/claude-code)

https://claude.ai/code/session_01VDtqoecgES7ScQYGbFVDRv

Co-authored-by: Claude <noreply@anthropic.com>

Author: objectstack-fleet[bot]

pnpm-lock.yaml

@@ -297,7 +297,12 @@ overrides:
   # declaration is now in the selector's scope and the lockfile records ^2.0.10 as its
   # specifier — the resolved version is unchanged at 2.0.12, because the ^2.0.10 target
   # floats to the newest 2.x (measured, #6095).
-  'brace-expansion@>=5.0.0 <6.0.0': '^5.0.9'
+  # brace-expansion, 2026-09-30 (#20769): three MORE advisories, GHSA-6j4f-fj2g-mc7p,
+  # GHSA-qhr7-859c-m2p7 and GHSA-q2hr-2g5m-vwhr, fixed in 5.0.12 — target lifted from
+  # ^5.0.9, selector stays at the <6.0.0 major boundary. This floor keeps THIS
+  # workspace's resolution from re-locking 5.0.9; overrides do not reach downstream
+  # installs, so a consumer's own brace-expansion copy is theirs to lift.
+  'brace-expansion@>=5.0.0 <6.0.0': '^5.0.12'
   'sharp@>=0.34.0 <0.36.0': '^0.35.4'
   'react-router@<8.3.0': '^8.3.0'
   '@sveltejs/kit@<2.69.1': '^2.69.1'
@@ -313,6 +318,11 @@ overrides:
   #     high each), fixed in 3.1.6 — target lifted from ^3.1.5, selector stays
   #     at the 4.0.0 boundary. ajv@8.20.0's ^3.0.1 already admits 3.1.6, so
   #     this is a dedupe onto the patched line, not a forced upgrade.
+  #     2026-09-30 (#20769): GHSA-hrr3-gc8f-f4qj, fixed in 3.1.8 — target lifted
+  #     from ^3.1.6, selector stays at the 4.0.0 boundary. ajv@8.20.0's ^3.0.1
+  #     admits 3.1.8, so this is again a dedupe onto the patched line. The floor
+  #     binds this workspace's resolution only; overrides do not reach downstream
+  #     installs.
   #   hono GHSA-8j4g-w8fx-2239 (5.3) — the one entry here that is NOT
   #     transitive-only: two versions resolved, 4.12.32 from our own packages
   #     and 4.12.33 pulled by @modelcontextprotocol/sdk. The override moves the
@@ -340,7 +350,7 @@ overrides:
   #     The declared ranges go to ^4.13.5 in lockstep for the downstream-install
   #     reason above; the @objectstack/hono PEER range stays ^4.12.8, unchanged,
   #     for the reason above it.
-  'fast-uri@<4.0.0': '^3.1.6'
+  'fast-uri@<4.0.0': '^3.1.8'
   'hono@<5.0.0': '^4.13.5'
   # OSV 2026-08-07 (#6407) — transitive-only, and the same "it has a fix, so
   # take the fix" disposition as the batch above: